We are hooking up Cloud Code to a Database; we want it to be only open to the Cloud Code IP, so it is more secure. We could not find resources documenting how we should address cross-backend communications. how can Cloud Code safely access our Database without opening it to the world?
No player can inspect the Cloud Code code. So you could even put the database credentials directly inside a cloud code script and it would be secure from users. You may still not want to do so, especially if you don’t want all employees to have those credentials.
You do still have to apply caution as to how you implement all the transactions. If at any time you pass in user input it needs to be sanitized to prevent SQL injection attacks. The sanitizing should be done in cloud code because the client could be hacked.
you could even put the database credentials directly inside a cloud code script and it would be secure from users
Its not something we can recommend until we can provide secret management.
We do provide a JWS endpoint for validating the cloud code service tokens https://cloud-code.services.api.unity.com/.well-known/jwks.json so external requests can be authenticated using the service token as the bearer token that you can validate on your side.
I wouldn’t recommend it either but is there any other possible security issue when doing so besides the accessibility by anyone who can view the script?
The risk is not with players, who can never access the secrets, but with other developers in larger teams.
I dont want an intern getting access to a database connection string and … “fixing a bug” 
.
Additionally, if you version-control your code (which of course you should) that also poses a mild risk if you accidentally make the repo public, or its open source, etc.
I agree, however, that if you’re solo or a small team, then you will almost certainly be fine.
Then that’s my thoughts exactly. 
(also the disgruntled employee who wipes the database and quits … rare but happens)